MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b66c0e429e86b2f3f0071fa09ffd41a2be9694345dc83bdc843ff89fe57672e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b66c0e429e86b2f3f0071fa09ffd41a2be9694345dc83bdc843ff89fe57672e3
SHA3-384 hash: 161b21c403923e458ff633ddbc8b3c232b33d2083d07222128e2b7c85433221c9021f8b60c4961fa6ad695eb3556a888
SHA1 hash: 50484ee1f06c10e3fdb251a4585e1803617ed6dc
MD5 hash: 50cb15003268988541296f747fe6b059
humanhash: south-sixteen-wyoming-thirteen
File name:MT103-10122020.7z
Download: download sample
Signature Formbook
Create hunting rule
File size:459'035 bytes
First seen:2020-10-12 05:50:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:93zSSOmsY6j83QW0AmrWhIqygJ+S+ssUy4hjs17:93GSkj83QW0drPqVJ+S+8y4a
TLSH 9AA4231964F7F3D49092C6C44BFCC45493F2AE8B25B5EF861816E8CF68C518E0581BEE
Reporter abuse_ch
Tags:7z FormBook


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: lin128.loading.es
Sending IP: 91.146.100.128
From: payment.advice@hsbc.com.hk <admin@aragaza.com>
Subject: PAYMENT ADVICE.
Attachment: MT103-10122020.7z (contains "MT103-10122020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b66c0e429e86b2f3f0071fa09ffd41a2be9694345dc83bdc843ff89fe57672e3/
Threat name:
Win32.Trojan.LokibotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 02:13:25 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzwa4qu6q2zph4ahd6qj77kbuk7jnfbulxedxxeeh74j7zlwolrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b66c0e429e86b2f3f0071fa09ffd41a2be9694345dc83bdc843ff89fe57672e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

zip b66c0e429e86b2f3f0071fa09ffd41a2be9694345dc83bdc843ff89fe57672e3

(this sample)

Formbook

Executable exe 1b4249b0b590b4166f62a4e9fff3dfccc4d46cca9173d9c669311738fd98d2dd

  
Dropping
MD5 ba758c575363cec890e283c5301e09e7
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b4249b0b590b4166f62a4e9fff3dfccc4d46cca9173d9c669311738fd98d2dd

Comments